XRP Ledger patches decade‑old bug that could have minted trillions of XRP
The XRP Ledger’s payment‑engine code, written in 2015, contained an unchecked 64‑bit integer overflow that could have let an attacker create spendable XRP far beyond the 100 billion token cap. The flaw was disclosed on 9 Oct 2026 after researchers reported it on 22 Sept 2026, and RippleX released an emergency fix in xrpld 3.4.1 on 25 Sept 2026, activating the change on the network on 9 Oct 2026. No evidence of exploitation was found and more than 80 % of validators upgraded to the patched version within hours.
Why it matters
The fix preserves the fixed 100 billion XRP supply, preventing a potential dilution of the market that could have erased up to $94 billion of market value (the approximate value of the circulating supply). Investors can continue to rely on the supply cap when valuing XRP.
Key facts
- 1The vulnerability involved an unchecked 64‑bit integer overflow in the payment engine, allowing a wrap‑around that could create XRP beyond the 100 billion cap. gizmodo.com
- 2The bug was first reported to the XRPL bug bounty program on 22 Sept 2026. cryptoticker.io
- 3RippleX released xrpld 3.4.1 with the fix on 25 Sept 2026. cryptoticker.io
- 4The rule changes went live on the main network on 9 Oct 2026. cryptoticker.io
- 5The flaw could have created about 18 trillion XRP in a single transaction (approximately 180 times the 100 billion supply). cryptoslate.com
- 6More than 80 % of the 35 trusted validators had upgraded to the patched version by the end of 25 Sept 2026. gizmodo.com
Summary written by AlphAI AI Desk from 20 of 34 sources. Not investment advice. Figures are as stated by the linked sources.